WP Event Solution CVE-2026-103684

The affected component is the Arraytics WP Event Solution WordPress plugin at any version up to and including 4.1.25; the site must have this plugin installed and active for exploitation. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), no authentication, no user interaction, and no special non-default configuration are required - exploitation works against standard installations reachable over the network. The primary limiting factors are therefore the narrow blast radius (integrity-only impact: C:N/I:L/A:N, so no data disclosure or denial of service) and the requirement that the specific vulnerable plugin feature/endpoint be present in the installed version (≤4.1.25). Upgrading beyond the last affected version removes the exposure.

This is a genuinely moderate-priority issue, not a false alarm, but also not an emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes a network-reachable, low-complexity flaw requiring no authentication or user interaction, which maps to the CWE-862 Missing Authorization weakness (broken access control) reported by Patchstack. However, the impact is deliberately narrow: C:N/I:L/A:N means no confidentiality or availability loss and only limited integrity impact, which is why the score lands at 5.3 (Medium) rather than critical. No EPSS score, CISA KEV listing, or public POC was provided in the input, so exploitation likelihood signals are absent - this should be read as 'no public exploit identified at time of analysis,' NOT as evidence of safety. The SSVC framework cannot be fully evaluated because exploitation status and automatability are not supplied. Net assessment: a real unauthenticated access-control gap worth patching, but the limited (integrity-only) impact and lack of exploitation evidence place it below actively-exploited or data-exposure flaws in triage.

A remote, unauthenticated attacker sends a crafted HTTP request directly to a WP Event Solution plugin endpoint that fails to enforce an authorization/capability check, allowing them to invoke a privileged action and modify plugin-managed data (e.g., event records or settings) without logging in. Because CVSS shows AV:N/AC:L/PR:N/UI:N, no credentials, special timing, or victim interaction are needed. No public proof-of-concept was identified in the provided data.